1. Scope and organizational roles
This Privacy Notice applies to the Cardiology Insights website, cardiovascular assessments, assisted-scheduling request, contact verification, routing workflow, and Patient Access Command Center. Cardiology Insights operates the technology platform. Heart & Vascular Partners is the selected care organization that may receive a verified request and use it to contact, route, and schedule the patient.
After information is transmitted to a participating medical practice, that practice’s own privacy notice or HIPAA Notice of Privacy Practices may also apply. This notice does not replace a participating practice’s separate legal obligations.
2. Information we collect
Assessment information
The service may create an initially pseudonymous assessment session and collect information entered into the “I Know My Numbers” pathway or adaptive symptom pathway. Depending on the pathway, this may include age, sex, cardiovascular risk factors, cholesterol and blood-pressure values, symptoms, answer sequence, assessment result, ranked clinical-support output, urgency, recommended specialty, and routing destination.
Contact and access information
When a patient requests follow-up, the service collects first and last name, email address, mobile phone number, ZIP code, preferred contact method, selected or matched insurance plan, preferred location, consent, and contact-verification status.
Operational information
For a verified request, the system may record the assigned queue, employee owner, acknowledgment and contact deadlines, escalation state, contact attempts, notes, transfers, appointment status, and final disposition.
Security and technical information
To protect the system from automated, fraudulent, excessive, or repeated submissions, the service may process a protected network identifier, browser or session information, submission timing, verification attempts, duplicate indicators, rate-limit events, and anti-bot results. We do not place assessment answers in ordinary page URLs.
3. How information is used
Information is used to:
- provide the requested educational risk or symptom assessment;
- identify an appropriate urgency and type of cardiovascular care;
- recommend a specialty, physician, location, and assisted-access pathway;
- verify that the contact request is genuine;
- create, assign, monitor, escalate, and close a Patient Access Command Center task;
- contact the patient and assist with scheduling;
- apply insurance, capacity, geography, and access rules;
- prevent spam, fraud, misuse, and duplicate staff work;
- audit system activity, investigate problems, and improve quality and safety; and
- comply with contracts, legal requirements, and authorized customer instructions.
4. Adaptive clinical-support processing
The symptom pathway uses a versioned adaptive clinical-support engine to update a ranked differential and select follow-up questions from the information provided. Safety rules may override ranking and direct a patient to emergency care. The system supports screening, urgency, and routing; it does not establish a definitive diagnosis or replace professional medical judgment.
Authorized Cardiology Insights clinical and quality personnel may review simulated, de-identified, or appropriately authorized cases, regression results, and structured clinician feedback. Customer clinicians do not automatically change the live clinical engine. Proposed changes are reviewed, versioned, tested, and published through controlled clinical governance.
6. Security, verification, and abuse prevention
The production system is intended to use organization-scoped access controls, authenticated staff accounts, secure transport, protected credentials, audit records, backups, rate limits, duplicate detection, and verification controls. No security method can guarantee absolute protection, but the service is designed to reduce unauthorized access, lost requests, and abusive submissions.
A contact request may require a one-time code sent by text message or email. Unverified, suspicious, or blocked submissions do not enter the ordinary scheduling queue. Emergency instructions remain available regardless of whether a contact request is verified.
When configured, Cloudflare Turnstile may process browser and network signals to distinguish people from automated traffic. Cloudflare describes its Turnstile-specific practices in the Turnstile Privacy Addendum.
7. Retention and deletion
Assessment, contact, routing, access-task, verification, security, and audit records are retained only as long as reasonably necessary for patient-access operations, customer agreements, quality and safety, security investigations, legal obligations, and documented retention schedules. Unverified, blocked, or abandoned records may be retained for a limited fraud-prevention and troubleshooting period and then deleted or de-identified unless continued retention is required for an investigation or by law.
Production retention periods, deletion procedures, backup handling, and customer responsibilities must be documented in the applicable customer agreement and final retention schedule before launch.
8. Your choices and requests
- You may complete an assessment without submitting a request for follow-up.
- You may choose phone or email for verification and contact, subject to available configuration.
- You may decline or withdraw future contact by informing the participating organization or Cardiology Insights. Withdrawal does not affect processing already completed.
- You may request information about access, correction, deletion, or export, subject to identity verification and applicable contractual or legal limitations.
The service is intended for adults. Do not submit another person’s information unless you are legally authorized to do so.
9. Privacy contact
Notice version CI-PRIV-2026-07-29-01. Material revisions will be posted with a new version and effective date.